[SUSE-SU-2024:0525-1] Security update for libssh
Severity
Important
Affected Packages
32
CVEs
9
Security update for libssh
This update for libssh fixes the following issues:
Update to version 0.9.8 (jsc#PED-7719):
- Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209)
- Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126)
- Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186)
- Allow @ in usernames when parsing from URI composes
Update to version 0.9.7:
- Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188)
- Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions (bsc#1211190)
- Fix several memory leaks in GSSAPI handling code
Update to version 0.9.6 (bsc#1189608, CVE-2021-3634):
Update to 0.9.5 (bsc#1174713, CVE-2020-16135):
- CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)
- Improve handling of library initialization (T222)
- Fix parsing of subsecond times in SFTP (T219)
- Make the documentation reproducible
- Remove deprecated API usage in OpenSSL
- Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN
- Define version in one place (T226)
- Prevent invalid free when using different C runtimes than OpenSSL (T229)
- Compatibility improvements to testsuite
Update to version 0.9.4
- https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/
- Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699)
Update to version 0.9.3
- Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095)
- SSH-01-003 Client: Missing NULL check leads to crash in erroneous state
- SSH-01-006 General: Various unchecked Null-derefs cause DOS
- SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys
- SSH-01-010 SSH: Deprecated hash function in fingerprinting
- SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS
- SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access
- SSH-01-001 State Machine: Initial machine states should be set explicitly
- SSH-01-002 Kex: Differently bound macros used to iterate same array
- SSH-01-005 Code-Quality: Integer sign confusion during assignments
- SSH-01-008 SCP: Protocol Injection via unescaped File Names
- SSH-01-009 SSH: Update documentation which RFCs are implemented
- SSH-01-012 PKI: Information leak via uninitialized stack buffer
Update to version 0.9.2
- Fixed libssh-config.cmake
- Fixed issues with rsa algorithm negotiation (T191)
- Fixed detection of OpenSSL ed25519 support (T197)
Update to version 0.9.1
- Added support for Ed25519 via OpenSSL
- Added support for X25519 via OpenSSL
- Added support for localuser in Match keyword
- Fixed Match keyword to be case sensitive
- Fixed compilation with LibreSSL
- Fixed error report of channel open (T75)
- Fixed sftp documentation (T137)
- Fixed known_hosts parsing (T156)
- Fixed build issue with MinGW (T157)
- Fixed build with gcc 9 (T164)
- Fixed deprecation issues (T165)
Fixed known_hosts directory creation (T166)
Split out configuration to separate package to not mess up the
library packaging and coinstallation
Update to verion 0.9.0
- Added support for AES-GCM
- Added improved rekeying support
- Added performance improvements
- Disabled blowfish support by default
- Fixed several ssh config parsing issues
- Added support for DH Group Exchange KEX
- Added support for Encrypt-then-MAC mode
- Added support for parsing server side configuration file
- Added support for ECDSA/Ed25519 certificates
- Added FIPS 140-2 compatibility
- Improved known_hosts parsing
- Improved documentation
Improved OpenSSL API usage for KEX, DH, and signatures
Add libssh client and server config files
- ID
- SUSE-SU-2024:0525-1
- Severity
- important
- URL
- https://www.suse.com/support/update/announcement/2024/suse-su-20240525-1/
- Published
-
2024-02-19T07:04:14
(7 months ago) - Modified
-
2024-02-19T07:04:14
(7 months ago) - Rights
- Copyright 2024 SUSE LLC. All rights reserved.
- Other Advisories
-
- ALAS-2023-1898
- ALAS2-2023-2376
- ALPINE:CVE-2019-14889
- ALPINE:CVE-2020-16135
- ALPINE:CVE-2020-1730
- ALPINE:CVE-2021-3634
- ALPINE:CVE-2023-48795
- ALPINE:CVE-2023-6004
- ALPINE:CVE-2023-6918
- ALSA-2020:4545
- ALSA-2021:4387
- ALSA-2022:2031
- ALSA-2023:3839
- ALSA-2023:6643
- ALSA-2024:0606
- ALSA-2024:0628
- ALSA-2024:1130
- ALSA-2024:1150
- ALSA-2024:2504
- ALSA-2024:3233
- ASA-202004-11
- DSA-4965-1
- DSA-5409-1
- DSA-5586-1
- DSA-5588-1
- DSA-5591-1
- DSA-5599-1
- DSA-5600-1
- DSA-5601-1
- DSA-5750-1
- ELSA-2020-4545
- ELSA-2021-4387
- ELSA-2022-2031
- ELSA-2023-3839
- ELSA-2023-6643
- ELSA-2024-0606
- ELSA-2024-0628
- ELSA-2024-1130
- ELSA-2024-1150
- ELSA-2024-12157
- ELSA-2024-12158
- ELSA-2024-12164
- ELSA-2024-12232
- ELSA-2024-12233
- ELSA-2024-2504
- ELSA-2024-2988
- ELSA-2024-3233
- FEDORA-2019-46b6bd2459
- FEDORA-2019-8b0ad69829
- FEDORA-2020-5a77f0d68f
- FEDORA-2020-6cad41abb0
- FEDORA-2020-ac3e29073f
- FEDORA-2020-f4f5e49cb8
- FEDORA-2021-288925ac19
- FEDORA-2021-ec797b6a96
- FEDORA-2021-f2a020a065
- FEDORA-2023-0733306be9
- FEDORA-2023-153404713b
- FEDORA-2023-20feb865d8
- FEDORA-2023-55800423a8
- FEDORA-2023-5fa5ca2043
- FEDORA-2023-741d5f1fd3
- FEDORA-2023-b87ec6cf47
- FEDORA-2023-cb8c606fbb
- FEDORA-2023-e77300e4b5
- FEDORA-2024-06ebb70bdd
- FEDORA-2024-2705241461
- FEDORA-2024-37627e432e
- FEDORA-2024-39a8c72ea9
- FEDORA-2024-3bb23c77f3
- FEDORA-2024-3fd1bc9276
- FEDORA-2024-71c2c6526c
- FEDORA-2024-7b08207cdb
- FEDORA-2024-7e301327c2
- FEDORA-2024-a53b24023d
- FEDORA-2024-ae653fb07b
- FEDORA-2024-d946b9ad25
- FEDORA-2024-fb32950d11
- FREEBSD:0F7598CC-9FE2-11EE-B47F-901B0E9408DC
- FREEBSD:13D83980-9F18-11EE-8E38-002590C1F29C
- FREEBSD:1E7FA41B-F6CA-4FE8-BD46-0E176B42B14F
- FREEBSD:3D7DFD63-823B-11EA-B3A8-240A644DD835
- FREEBSD:4EBDD56B-FE72-11EE-BC57-00E081B7AA2D
- FREEBSD:57B1EE25-1A7C-11EC-9376-0800272221CC
- FREEBSD:91955195-9EBB-11EE-BC14-A703705DB3A6
- FREEBSD:B5E22EC5-BC4B-11EE-B0B5-B42E991FC52E
- GLSA-202003-27
- GLSA-202004-08
- GLSA-202011-05
- GLSA-202312-05
- GLSA-202312-16
- GLSA-202312-17
- GLSA-202407-11
- GLSA-202407-12
- GO-2023-2402
- JENKINS:SECURITY-3333
- JENKINS:SECURITY-3386
- openSUSE-SU-2019:2689-1
- openSUSE-SU-2020:0102-1
- openSUSE-SU-2020:0510-1
- openSUSE-SU-2023:0411-1
- openSUSE-SU-2023:0421-1
- openSUSE-SU-2024:0005-1
- openSUSE-SU-2024:0008-1
- openSUSE-SU-2024:0036-1
- RHBA-2024:1127
- RHBA-2024:1136
- RHSA-2020:4545
- RHSA-2021:4387
- RHSA-2022:2031
- RHSA-2023:3839
- RHSA-2023:6643
- RHSA-2024:0606
- RHSA-2024:0628
- RHSA-2024:1130
- RHSA-2024:1150
- RHSA-2024:2504
- RHSA-2024:2988
- RHSA-2024:3233
- RLSA-2022:2031
- RLSA-2023:3839
- RLSA-2024:0606
- RLSA-2024:0628
- RLSA-2024:3233
- SSA:2023-124-01
- SSA:2023-353-01
- SSA:2023-354-01
- SUSE-SU-2019:3267-1
- SUSE-SU-2019:3293-1
- SUSE-SU-2019:3307-1
- SUSE-SU-2019:3308-1
- SUSE-SU-2020:0129-1
- SUSE-SU-2020:0130-1
- SUSE-SU-2020:0131-1
- SUSE-SU-2020:0139-1
- SUSE-SU-2020:0967-1
- SUSE-SU-2020:0968-1
- SUSE-SU-2023:4902-1
- SUSE-SU-2023:4903-1
- SUSE-SU-2023:4904-1
- SUSE-SU-2023:4905-1
- SUSE-SU-2023:4946-1
- SUSE-SU-2024:0006-1
- SUSE-SU-2024:0035-1
- SUSE-SU-2024:0140-1
- SUSE-SU-2024:0210-1
- SUSE-SU-2024:0224-1
- SUSE-SU-2024:0327-1
- SUSE-SU-2024:0430-1
- SUSE-SU-2024:0460-1
- SUSE-SU-2024:0539-1
- SUSE-SU-2024:0543-1
- SUSE-SU-2024:0558-1
- SUSE-SU-2024:0972-1
- SUSE-SU-2024:0974-1
- USN-4219-1
- USN-4327-1
- USN-4447-1
- USN-5053-1
- USN-6138-1
- USN-6560-1
- USN-6560-2
- USN-6561-1
- USN-6585-1
- USN-6589-1
- USN-6592-1
- USN-6592-2
- USN-6598-1
- USN-6738-1
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:rpm/suse/libssh4?arch=x86_64&distro=sles-15&sp=3 | suse | libssh4 | < 0.9.8-150200.13.3.1 | sles-15 | x86_64 | |
Affected | pkg:rpm/suse/libssh4?arch=x86_64&distro=sles-15&sp=2 | suse | libssh4 | < 0.9.8-150200.13.3.1 | sles-15 | x86_64 | |
Affected | pkg:rpm/suse/libssh4?arch=x86_64&distro=slem-5 | suse | libssh4 | < 0.9.8-150200.13.3.1 | slem-5 | x86_64 | |
Affected | pkg:rpm/suse/libssh4?arch=s390x&distro=sles-15&sp=3 | suse | libssh4 | < 0.9.8-150200.13.3.1 | sles-15 | s390x | |
Affected | pkg:rpm/suse/libssh4?arch=s390x&distro=sles-15&sp=2 | suse | libssh4 | < 0.9.8-150200.13.3.1 | sles-15 | s390x | |
Affected | pkg:rpm/suse/libssh4?arch=s390x&distro=slem-5 | suse | libssh4 | < 0.9.8-150200.13.3.1 | slem-5 | s390x | |
Affected | pkg:rpm/suse/libssh4?arch=ppc64le&distro=sles-15&sp=3 | suse | libssh4 | < 0.9.8-150200.13.3.1 | sles-15 | ppc64le | |
Affected | pkg:rpm/suse/libssh4?arch=ppc64le&distro=sles-15&sp=2 | suse | libssh4 | < 0.9.8-150200.13.3.1 | sles-15 | ppc64le | |
Affected | pkg:rpm/suse/libssh4?arch=aarch64&distro=sles-15&sp=3 | suse | libssh4 | < 0.9.8-150200.13.3.1 | sles-15 | aarch64 | |
Affected | pkg:rpm/suse/libssh4?arch=aarch64&distro=sles-15&sp=2 | suse | libssh4 | < 0.9.8-150200.13.3.1 | sles-15 | aarch64 | |
Affected | pkg:rpm/suse/libssh4?arch=aarch64&distro=slem-5 | suse | libssh4 | < 0.9.8-150200.13.3.1 | slem-5 | aarch64 | |
Affected | pkg:rpm/suse/libssh4-32bit?arch=x86_64&distro=sles-15&sp=3 | suse | libssh4-32bit | < 0.9.8-150200.13.3.1 | sles-15 | x86_64 | |
Affected | pkg:rpm/suse/libssh4-32bit?arch=x86_64&distro=sles-15&sp=2 | suse | libssh4-32bit | < 0.9.8-150200.13.3.1 | sles-15 | x86_64 | |
Affected | pkg:rpm/suse/libssh-devel?arch=x86_64&distro=sles-15&sp=3 | suse | libssh-devel | < 0.9.8-150200.13.3.1 | sles-15 | x86_64 | |
Affected | pkg:rpm/suse/libssh-devel?arch=x86_64&distro=sles-15&sp=2 | suse | libssh-devel | < 0.9.8-150200.13.3.1 | sles-15 | x86_64 | |
Affected | pkg:rpm/suse/libssh-devel?arch=s390x&distro=sles-15&sp=3 | suse | libssh-devel | < 0.9.8-150200.13.3.1 | sles-15 | s390x | |
Affected | pkg:rpm/suse/libssh-devel?arch=s390x&distro=sles-15&sp=2 | suse | libssh-devel | < 0.9.8-150200.13.3.1 | sles-15 | s390x | |
Affected | pkg:rpm/suse/libssh-devel?arch=ppc64le&distro=sles-15&sp=3 | suse | libssh-devel | < 0.9.8-150200.13.3.1 | sles-15 | ppc64le | |
Affected | pkg:rpm/suse/libssh-devel?arch=ppc64le&distro=sles-15&sp=2 | suse | libssh-devel | < 0.9.8-150200.13.3.1 | sles-15 | ppc64le | |
Affected | pkg:rpm/suse/libssh-devel?arch=aarch64&distro=sles-15&sp=3 | suse | libssh-devel | < 0.9.8-150200.13.3.1 | sles-15 | aarch64 | |
Affected | pkg:rpm/suse/libssh-devel?arch=aarch64&distro=sles-15&sp=2 | suse | libssh-devel | < 0.9.8-150200.13.3.1 | sles-15 | aarch64 | |
Affected | pkg:rpm/suse/libssh-config?arch=x86_64&distro=sles-15&sp=3 | suse | libssh-config | < 0.9.8-150200.13.3.1 | sles-15 | x86_64 | |
Affected | pkg:rpm/suse/libssh-config?arch=x86_64&distro=sles-15&sp=2 | suse | libssh-config | < 0.9.8-150200.13.3.1 | sles-15 | x86_64 | |
Affected | pkg:rpm/suse/libssh-config?arch=x86_64&distro=slem-5 | suse | libssh-config | < 0.9.8-150200.13.3.1 | slem-5 | x86_64 | |
Affected | pkg:rpm/suse/libssh-config?arch=s390x&distro=sles-15&sp=3 | suse | libssh-config | < 0.9.8-150200.13.3.1 | sles-15 | s390x | |
Affected | pkg:rpm/suse/libssh-config?arch=s390x&distro=sles-15&sp=2 | suse | libssh-config | < 0.9.8-150200.13.3.1 | sles-15 | s390x | |
Affected | pkg:rpm/suse/libssh-config?arch=s390x&distro=slem-5 | suse | libssh-config | < 0.9.8-150200.13.3.1 | slem-5 | s390x | |
Affected | pkg:rpm/suse/libssh-config?arch=ppc64le&distro=sles-15&sp=3 | suse | libssh-config | < 0.9.8-150200.13.3.1 | sles-15 | ppc64le | |
Affected | pkg:rpm/suse/libssh-config?arch=ppc64le&distro=sles-15&sp=2 | suse | libssh-config | < 0.9.8-150200.13.3.1 | sles-15 | ppc64le | |
Affected | pkg:rpm/suse/libssh-config?arch=aarch64&distro=sles-15&sp=3 | suse | libssh-config | < 0.9.8-150200.13.3.1 | sles-15 | aarch64 | |
Affected | pkg:rpm/suse/libssh-config?arch=aarch64&distro=sles-15&sp=2 | suse | libssh-config | < 0.9.8-150200.13.3.1 | sles-15 | aarch64 | |
Affected | pkg:rpm/suse/libssh-config?arch=aarch64&distro=slem-5 | suse | libssh-config | < 0.9.8-150200.13.3.1 | slem-5 | aarch64 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |